# DepVet Package Risk Check

> DepVet Package Risk Check is a paid API for AI agents from depvet.imac2014ville.workers.dev, paid per call via x402, $0.005/call, status unknown (last checked 2026-10-12).

Returns an OK/REVIEW/AVOID verdict for an npm or PyPI package based on vulnerabilities, malware, license risk, deprecation, maintenance health, OpenSSF Scorecard, and typosquat detection

## Facts

- Endpoint: GET https://depvet.imac2014ville.workers.dev/check?utm_source=zero.xyz
- Price: $0.005/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/depvet-package-risk-check-087aca33
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_C1pT8IZBicwiBQnlIV-6Q

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability depvet-package-risk-check-087aca33
```

Example prompt: Before I add it to my project, check whether the npm package 'axios' is safe to use — I want to know about any vulnerabilities, malware flags, license issues, or signs it might be a typosquat.

## When to prefer this

Use DepVet when an AI agent needs a fast, pre-install security verdict on a specific npm or PyPI package — especially in automated workflows, CI/CD pipelines, or agentic coding assistants where you want a single opinionated OK/REVIEW/AVOID signal rather than raw CVE data. It is ideal for agents that cannot afford to parse multiple upstream security feeds themselves. Prefer this over manual OSV queries when you also need license risk, typosquat hints, and maintenance health in one call.

## Known failure modes

- Package not found in the specified ecosystem — returns an error or non-OK status
- Invalid ecosystem value (only 'npm' and 'pypi' are supported)
- Payment failure via x402 — call is rejected before analysis runs
- Version string does not exist for the given package — may fall back to latest or return error
- Network timeout reaching upstream data sources (OSV, OpenSSF)
- Rate limiting or temporary worker unavailability on the Cloudflare Workers backend

## How this service works

NPM supply chain attack and malicious package check for npm and PyPI: typosquat detection, dependency vulnerability scan (CVE/OSV), license check, OpenSSF Scorecard. OK/REVIEW/AVOID verdict before you install. No API key: pay USDC on Base per call via x402.

## Output

A JSON object containing: overall verdict (OK, REVIEW, or AVOID), package name, version, ecosystem, license name and risk level (permissive/copyleft/unknown), deprecation flag, vulnerability summary (count, malware boolean, max severity), and a typosquat suspicion boolean. All signal sources include OSV vulnerability data, malware advisories, and OpenSSF Scorecard.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "queryParams": {
     "type": "object",
     "required": [
      "ecosystem",
      "name"
     ],
     "properties": {
      "name": {
       "type": "string",
       "description": "Package name, e.g. express, @types/node, requests"
      },
      "version": {
       "type": "string",
       "description": "Exact version (default: latest)"
      },
      "ecosystem": {
       "enum": [
        "npm",
        "pypi"
       ],
       "type": "string",
       "description": "Package ecosystem"
      }
     }
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "name": "requests",
  "license": "Apache-2.0",
  "verdict": "OK",
  "version": "2.32.3",
  "ecosystem": "pypi",
  "deprecated": false,
  "licenseRisk": "permissive",
  "vulnerabilities": {
   "count": 0,
   "malware": false,
   "maxSeverity": "NONE"
  },
  "typosquatSuspect": false
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/depvet-package-risk-check-087aca33/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from depvet.imac2014ville.workers.dev](https://www.zero.xyz/host/depvet.imac2014ville.workers.dev/llms.txt)